IOC Report
45Ywq5ad5H.exe

loading gif

Files

File Path
Type
Category
Malicious
45Ywq5ad5H.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_45Ywq5ad5H.exe_8eca8130e91a8ee9f72171e4fd9f47ee21ca84b9_22f34bbd_2b804235-464d-4351-859e-52f91f60e163\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\userJKECGDBFCB.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\a43486128347[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\BKFBAKFCBFHIJJJJDBFCAFIEBK
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\CFCBFBGD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\DGIJECGDGCBKECAKFBGC
ASCII text, with very long lines (1769), with CRLF line terminators
dropped
C:\ProgramData\DHIJEHJDHJKECBFHDHDH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EGIIIECB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GIEBAECAKKFCBFIEGCBK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\GIEHIDHJDBFIIECAKECBKJJKKE
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\IEHIIIJDAAAAAAKECBFBAEBKJJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
dropped
C:\ProgramData\JKKEBGCGHIDHCBFHIDGHCBKEHC
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_389075c441d8512dd9105bf88b134bcff04487_85207d7d_8b5323c9-f294-43af-8b6b-6924b0c7fca4\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_f5b4a6202a53ee73c263cc4c99e711b13cd935ac_85207d7d_d90f5740-82d0-408b-9330-f8c63df3c7a7\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
modified
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_userJKECGDB_ec2bdbc4a748ddb3a9d0e4b881f74ac7c0614331_cd332b32_c166ec7e-8924-4ff9-a801-a2230153390f\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3C8D.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Oct 7 16:43:07 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D3A.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D6A.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D5F.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Oct 7 16:43:24 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DAE.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DFD.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A4F.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A70.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBB26.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBB46.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\WER8A80.tmp.WERDataCollectionStatus.txt
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\WERAB46.tmp.WERDataCollectionStatus.txt
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm
data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 33 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\45Ywq5ad5H.exe
"C:\Users\user\Desktop\45Ywq5ad5H.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Users\userJKECGDBFCB.exe
"C:\Users\userJKECGDBFCB.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 268
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userJKECGDBFCB.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 284
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 1660
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 1680

URLs

Name
IP
Malicious
frizzettei.sbs
malicious
http://46.8.231.109/c4754d4f680ead72.php
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll#
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
46.8.231.109
 malicious
laddyirekyi.sbs
malicious
isoplethui.sbs
malicious
http://46.8.231.109/c4754d4f680ead72.phpe
unknown
 malicious
http://46.8.231.109/c4754d4f680ead72.php8
unknown
 malicious
http://46.8.231.109/c4754d4f680ead72.php3
unknown
 malicious
http://46.8.231.109/
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
46.8.231.109
 malicious
http://46.8.231.109/c4754d4f680ead72.phpH
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
46.8.231.109
 malicious
invinjurhey.sbs
malicious
exilepolsiy.sbs
malicious
http://46.8.231.109/c4754d4f680ead72.php44
unknown
 malicious
http://46.8.231.109ECGDBFCBdata;
unknown
 malicious
https://wickedneatr.sbs/api
188.114.96.3
 malicious
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dllI
unknown
 malicious
http://46.8.231.109
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
46.8.231.109
 malicious
bemuzzeki.sbs
malicious
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
46.8.231.109
 malicious
exemplarou.sbs
malicious
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll1
unknown
 malicious
http://46.8.231.109/c4754d4f680ead72.phpHc
unknown
 malicious
wickedneatr.sbs
malicious
https://isoplethui.sbs/api
104.21.74.165
 malicious
http://46.8.231.109/c4754d4f680ead72.phpry=----HIDAFHDHCBGDGCBGCGIIdefault-releasetargeting.snapshot
unknown
 malicious
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://wickedneatr.sbs/
unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
147.45.44.104
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe)
unknown
https://wickedneatr.sbs/pi5bmw
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://upx.sf.net
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://wickedneatr.sbs/api-
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exeY
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
unknown
There are 50 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
wickedneatr.sbs
188.114.96.3
 malicious
isoplethui.sbs
104.21.74.165
 malicious
frizzettei.sbs
unknown
 malicious
laddyirekyi.sbs
unknown
 malicious
bemuzzeki.sbs
unknown
 malicious
invinjurhey.sbs
unknown
 malicious
exilepolsiy.sbs
unknown
 malicious
exemplarou.sbs
unknown
 malicious
bg.microsoft.map.fastly.net
199.232.214.172
nsdm.cumpar-auto-orice-tip.ro
147.45.44.104
s-part-0017.t-0009.t-msedge.net
13.107.246.45
time.windows.com
unknown
There are 2 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
46.8.231.109
unknown
Russian Federation
malicious
188.114.96.3
wickedneatr.sbs
European Union
malicious
104.21.74.165
isoplethui.sbs
United States
malicious
147.45.44.104
nsdm.cumpar-auto-orice-tip.ro
Russian Federation

Registry

Path
Value
Malicious
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
ProgramId
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
FileId
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
LowerCaseLongPath
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
LongPathHash
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
Name
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
OriginalFileName
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
Publisher
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
Version
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
BinFileVersion
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
BinaryType
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
ProductName
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
ProductVersion
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
LinkDate
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
BinProductVersion
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
AppxPackageFullName
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
AppxPackageRelativeId
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
Size
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
Language
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\45ywq5ad5h.exe|a111b782d95e6910
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
ProgramId
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
FileId
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
LowerCaseLongPath
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
LongPathHash
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
Name
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
OriginalFileName
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
Publisher
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
Version
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
BinFileVersion
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
BinaryType
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
ProductName
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
ProductVersion
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
LinkDate
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
BinProductVersion
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
AppxPackageFullName
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
AppxPackageRelativeId
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
Size
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
Language
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\userjkecgdb|27dc00df7fa91f6a
Usn
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
ProgramId
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
FileId
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
LowerCaseLongPath
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
LongPathHash
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
Name
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
OriginalFileName
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
Publisher
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
Version
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
BinFileVersion
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
BinaryType
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
ProductName
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
ProductVersion
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
LinkDate
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
BinProductVersion
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
AppxPackageFullName
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
AppxPackageRelativeId
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
Size
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
Language
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
IsOsComponent
\REGISTRY\A\{cf98ddf3-76bd-9029-8694-1ca911aac4e7}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
00184010F9A9C8F4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
00184010F9A9C8F4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
There are 55 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
ED000
unkown
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
1347000
heap
page read and write
 malicious
9FD000
unkown
page read and write
 malicious
12AA000
heap
page read and write
27618000
heap
page read and write
275B1000
heap
page read and write
2760E000
heap
page read and write
E4F000
heap
page read and write
122E000
stack
page read and write
DA0000
heap
page read and write
488000
remote allocation
page execute and read and write
BD0000
heap
page read and write
1110000
heap
page read and write
6C500000
unkown
page readonly
2E7E000
stack
page read and write
A4C000
unkown
page readonly
148000
unkown
page readonly
704B1000
unkown
page execute read
78A000
heap
page read and write
45A000
remote allocation
page execute and read and write
148000
unkown
page readonly
6C77F000
unkown
page write copy
312E000
stack
page read and write
E3000
unkown
page readonly
51B000
remote allocation
page execute and read and write
2D6A0000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1B490000
heap
page read and write
21500000
heap
page read and write
C1000
unkown
page execute read
29FE000
stack
page read and write
2152A000
heap
page read and write
6C5A1000
unkown
page execute read
2160C000
heap
page read and write
10FD000
stack
page read and write
287D000
stack
page read and write
4E2000
remote allocation
page execute and read and write
21513000
heap
page read and write
6C592000
unkown
page readonly
A6B000
stack
page read and write
704CF000
unkown
page readonly
BC0000
heap
page read and write
AAE000
stack
page read and write
6C57D000
unkown
page readonly
51E000
remote allocation
page execute and read and write
796000
heap
page read and write
C40000
heap
page read and write
12AE000
heap
page read and write
E74000
heap
page read and write
1B06D000
stack
page read and write
2762A000
heap
page read and write
2FBE000
stack
page read and write
27570000
heap
page read and write
BD0000
heap
page read and write
1B1EE000
stack
page read and write
27590000
heap
page read and write
1B1AC000
stack
page read and write
33BE000
stack
page read and write
6C501000
unkown
page execute read
61ECC000
direct allocation
page read and write
75E000
stack
page read and write
11AF000
stack
page read and write
1388000
heap
page read and write
1340000
heap
page read and write
A4C000
unkown
page readonly
170C000
heap
page read and write
890000
heap
page read and write
322F000
stack
page read and write
C20000
heap
page read and write
61EB4000
direct allocation
page read and write
48F000
remote allocation
page execute and read and write
A6F000
stack
page read and write
1B592000
heap
page read and write
C1E000
stack
page read and write
61E01000
direct allocation
page execute read
780000
heap
page read and write
21515000
heap
page read and write
9D0000
unkown
page readonly
C1000
unkown
page execute read
104E000
stack
page read and write
64A000
remote allocation
page execute and read and write
1B2EF000
stack
page read and write
10F2000
stack
page read and write
DBD000
heap
page read and write
1280000
heap
page read and write
1AF6E000
stack
page read and write
D60000
heap
page read and write
78E000
heap
page read and write
BAF000
stack
page read and write
4EF000
remote allocation
page execute and read and write
A4A000
unkown
page execute and read and write
2762E000
heap
page read and write
6C58E000
unkown
page read and write
C0000
unkown
page readonly
DA8000
heap
page read and write
3AD000
stack
page read and write
61ED0000
direct allocation
page read and write
B6D000
stack
page read and write
45E000
remote allocation
page execute and read and write
DCD000
heap
page read and write
12CE000
stack
page read and write
1230000
heap
page read and write
1B42D000
stack
page read and write
146000
unkown
page read and write
21503000
heap
page read and write
C46000
heap
page read and write
ED000
unkown
page write copy
1AE2E000
stack
page read and write
A4B000
unkown
page read and write
5A5000
remote allocation
page execute and read and write
700000
heap
page read and write
34310000
heap
page read and write
2AFC000
stack
page read and write
6C785000
unkown
page readonly
9F3000
unkown
page readonly
65C000
remote allocation
page execute and read and write
275D2000
heap
page read and write
1B0AE000
stack
page read and write
145000
unkown
page execute and read and write
50F000
remote allocation
page execute and read and write
6C73F000
unkown
page readonly
9D1000
unkown
page execute read
6C780000
unkown
page read and write
1B480000
heap
page read and write
5C5000
remote allocation
page execute and read and write
6FD000
stack
page read and write
704CD000
unkown
page read and write
27637000
heap
page read and write
32B0000
heap
page read and write
492000
remote allocation
page execute and read and write
9D0000
unkown
page readonly
2F7F000
stack
page read and write
6C77E000
unkown
page read and write
9D1000
unkown
page execute read
F9E000
stack
page read and write
61ECD000
direct allocation
page readonly
275F2000
heap
page read and write
D5E000
stack
page read and write
12F0000
heap
page read and write
2150C000
heap
page read and write
149F000
stack
page read and write
28BD000
stack
page read and write
C0000
unkown
page readonly
B6B000
stack
page read and write
6C5A0000
unkown
page readonly
109F000
stack
page read and write
153E000
stack
page read and write
DAC000
stack
page read and write
704B0000
unkown
page readonly
4BD000
remote allocation
page execute and read and write
10A0000
heap
page read and write
61ED3000
direct allocation
page read and write
1285000
heap
page read and write
2762C000
heap
page read and write
E58000
heap
page read and write
61EB7000
direct allocation
page readonly
5CB000
remote allocation
page execute and read and write
2E1E000
stack
page read and write
1AF2F000
stack
page read and write
61ED4000
direct allocation
page readonly
710000
heap
page read and write
1700000
heap
page read and write
E3000
unkown
page readonly
12A0000
heap
page read and write
485000
remote allocation
page execute and read and write
9FD000
unkown
page write copy
13A2000
heap
page read and write
704C6000
unkown
page readonly
28F0000
heap
page read and write
27612000
heap
page read and write
DF0000
heap
page read and write
329D000
stack
page read and write
EFD000
stack
page read and write
10F8000
stack
page read and write
21527000
heap
page read and write
9F3000
unkown
page readonly
30BE000
stack
page read and write
1703000
heap
page read and write
4B1000
remote allocation
page execute and read and write
1B32E000
stack
page read and write
100E000
stack
page read and write
There are 173 hidden memdumps, click here to show them.